CloudTrail delivered logs to CloudWatch in last 24 hours

Check ID: cloudtrail_cloudwatch_logging_enabled
Provider: AWS
Service: cloudtrail
Severity: LOW
Categories: logging, forensics-ready
Resource type: AwsCloudTrailTrail

What this check verifies

CloudTrail trails are configured to send events to CloudWatch Logs, and show recent delivery within the last 24h. Trails without integration or without recent CloudWatch delivery are identified, across single-Region and multi-Region trails.

Risk

Missing or stale CloudWatch delivery weakens visibility and delays detection, impacting confidentiality and integrity. Adversaries can:

Hide privilege escalation
Perform unauthorized resource changes
Exfiltrate data via API misuse

Recommendation

Integrate every trail with CloudWatch Logs and maintain continuous, near-real-time delivery. Enforce least privilege on the delivery role, prefer multi-Region coverage, and implement metric filters and alerts for sensitive actions. Centralize retention to support defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudtrail update-trail —name <trail_name> —cloud-watch-logs-log-group-arn <cloudwatch_log_group_arn> —cloud-watch-logs-role-arn <cloudwatch_logs_role_arn>

# Terraform: enable CloudTrail delivery to CloudWatch Logs
resource "aws_cloudtrail" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  s3_bucket_name             = "<example_resource_name>"
  cloud_watch_logs_group_arn = "<cloudwatch_log_group_arn>"  # CRITICAL: sends CloudTrail events to CloudWatch Logs
  cloud_watch_logs_role_arn  = "<cloudwatch_logs_role_arn>"   # CRITICAL: role CloudTrail assumes to deliver events
}

# CloudFormation: enable CloudTrail delivery to CloudWatch Logs
Resources:
  <example_resource_name>:
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: "<example_resource_name>"
      CloudWatchLogsLogGroupArn: "<cloudwatch_log_group_arn>"  # CRITICAL: sends CloudTrail events to CloudWatch Logs
      CloudWatchLogsRoleArn: "<cloudwatch_logs_role_arn>"      # CRITICAL: role CloudTrail assumes to deliver events

References

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_cloudwatch_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudTrail trail S3 bucket has MFA delete enabled CloudTrail trail has Insights enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires